SimplrSSH - Code Scan - 2026-10-17

[bluenevus]

Findings

1. Medium - form POST can be redirected from HTTPS to plain HTTP (main/portal_client.cpp, fetch()). A 307/308 redirect keeps the request body. A sign-in page served over HTTPS could redirect a submitted form (name, email, voucher code, password fields) to an http:// address, so it would go out unencrypted. Cookies already honour Secure, but the body did not. Impact: anyone on the joined network could read what the user typed. Exploitable by the untrusted network's own page.

Other areas reviewed: command/format-string use, unsafe C string calls, crypto primitives, CI workflows (actions pinned to SHAs, minimal permissions, inputs passed through env), the OpenAI client (CA bundle attached), and the portal client's other redirect and cookie handling. Nothing else needed a change.

Plan

• Refuse a redirect that would carry a POST body from an HTTPS page to an HTTP URL. Files: main/portal_client.cpp, SECURITY.md. Verify with the guard tests.

Final gap analysis

• Redirect check: done.
• Firmware compile and host unit test of the change: not done. ESP-IDF isn't in this container, and libmbedtls-dev couldn't be installed, so scripts/check.sh stopped at the host-test cmake step.
• A host test for the new check: not done. portal_client.cpp is an ESP-IDF HTTP client and isn't host-tested.
• Hardware behavior: not confirmed on a T-Deck or Tab5.

Deferred

• None. No dependency audit tool was runnable here (ESP-IDF component lockfiles only), and SAST (scripts/sast.sh) wasn't run locally (needs docker and an ECR login). CI's security scan will run it.

Verification

• cd test/guards && python3 -m unittest test_supply_chain test_firmware_rules test_rules_file test_ci_scripts: 94 tests, OK.
• scripts/check.sh: guards passed; host build failed (missing mbedcrypto library in this container).

---

Generated by Claude Code